octo | 1dda2398fb3c4c2aee9b2a18f0975b921cbd2809625618d7a91d174806c677b7

Resubmissions

03-05-2024 05:43

240503-genrssae99 10

03-05-2024 05:43

03-05-2024 05:42

26-04-2024 11:24

26-04-2024 09:55

26-04-2024 09:35

Analysis

max time kernel
37s
max time network
137s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
03-05-2024 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1dda2398fb3c4c2aee9b2a18f0975b921cbd2809625618d7a91d174806c677b7.apk
Size

509KB
MD5

398d22e2d522ad3b4dec483d095ab0a0
SHA1

57864eac5ff484b9943bb30657a5b8b521a04068
SHA256

1dda2398fb3c4c2aee9b2a18f0975b921cbd2809625618d7a91d174806c677b7
SHA512

7d4c8aad0e3ea2fda730554f4fa8220567b94cf0e6a7c3d93112ea1b0b11cc972b00b3d00346976e664cdf82d672f94185f5868df9c6b9b81b2bee9748649b7b
SSDEEP

12288:+f22AykQKMrEjYTYVk5B+vdosmXw91+9VYATRWcOqZUeJnPG:+55QjYTPMvdjmXw9M31W5MJnPG

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

https://tecbabbshop24578.shop/ZDQyN2NmOGEZOTIK/

https://karamdsadvs2.shop/ZDQyN2NmOGEZOTIK/

https://karakalandankasd5.com/ZDQyN2NmOGEZOTIK/

https://tecklardankalan.shop/ZDQyN2NmOGEZOTIK/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 1 IoCs

Processes:

resource	yara_rule
/data/data/com.beautyship5/cache/qhqrdtmuyib	family_octo

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.beautyship5

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.beautyship5
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.beautyship5

Prevents application removal 1 TTPs 1 IoCs
Application may abuse the framework's APIs to prevent removal.
evasion

Prevent Application Removal
T1629.001

Processes:

com.beautyship5

description ioc process

Framework service call android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.beautyship5
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.beautyship5

pid process

4182 com.beautyship5
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
collection credential_access

Access Notifications
T1517

Processes:

com.beautyship5

description ioc process

Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.beautyship5
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.beautyship5

description ioc process

File opened for read /proc/cpuinfo com.beautyship5
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.beautyship5

description ioc process

File opened for read /proc/meminfo com.beautyship5
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.beautyship5

ioc pid process

/data/user/0/com.beautyship5/cache/qhqrdtmuyib 4182 com.beautyship5
/data/user/0/com.beautyship5/cache/qhqrdtmuyib 4182 com.beautyship5
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.beautyship5

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.beautyship5
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.beautyship5

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.beautyship5
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.beautyship5

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.beautyship5
Acquires the wake lock 1 IoCs

Processes:

com.beautyship5

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.beautyship5
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
evasion

User Evasion
T1628.002

Processes:

com.beautyship5

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.beautyship5
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.beautyship5

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.beautyship5

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.beautyship5

pid	process
4182	com.beautyship5

description	ioc	process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.beautyship5

description	ioc	process
File opened for read	/proc/cpuinfo	com.beautyship5

description	ioc	process
File opened for read	/proc/meminfo	com.beautyship5

ioc	pid	process
/data/user/0/com.beautyship5/cache/qhqrdtmuyib	4182	com.beautyship5
/data/user/0/com.beautyship5/cache/qhqrdtmuyib	4182	com.beautyship5

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.beautyship5

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.beautyship5

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.beautyship5

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.beautyship5

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.beautyship5

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.beautyship5

com.beautyship5
1⤵
- Makes use of the framework's Accessibility service
- Prevents application removal
- Removes its main activity from the application launcher
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4182

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Access Notifications

T1517

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.beautyship5/cache/qhqrdtmuyib
Filesize
449KB

MD5
7cfcfcdf2f1a2e962d3975435a55b97d

SHA1
0e3b3c6e167542c580dec3a674f2fc3b4e91628d

SHA256
abe48a2b945177b37b9f59db9f4d8f92ea9dc991f0835b7df3191e937b6d8929

SHA512
eafb08deef09f5b4644c42e9bccac724dd5ba0345f43ea5cbc4ca8286b6ee34e579fa6195fbff24ceeb5e25db521e44edd99cc4d9a5691405e0e1f71b805548a

Download Submit
/data/data/com.beautyship5/kl.txt
Filesize
28B

MD5
6311c3fd15588bb5c126e6c28ff5fffe

SHA1
ce81d136fce31779f4dd62e20bdaf99c91e2fc57

SHA256
8b82f6032e29a2b5c96031a3630fb6173d12ff0295bc20bb21b877d08f0812d8

SHA512
2975fe2e94b6a8adc9cfc1a865ad113772b54572883a537b02a16dd2d029c0f7d9cca3b154fd849bdfe978e18b396bcf9fa6e67e7c61f92bdc089a29a9c355c6

Download Submit
/data/data/com.beautyship5/kl.txt
Filesize
237B

MD5
b8c1f6814152fcb7b59b2e85a6bdc4f3

SHA1
bcdeff7d2393de66e781719ad0322634cefee556

SHA256
a085baef3250f11e00ee04a4596f370b1a16d989dea1bc711bf856ff6cf5cf17

SHA512
aeed8618190961ca1b4e7358bb0c3782657988370017b2fb0d3e28261699095213566e9e8b90d760a5bbe3db9dbb8aca14a461df5d1da6118dad06bf647d3819

Download Submit
/data/data/com.beautyship5/kl.txt
Filesize
63B

MD5
122bd64537df474ac891bd955278a92a

SHA1
721634253326c978860831c7c8c59496949da197

SHA256
11b3fd4d3e8f463a3dca8b6e0b9fa68e0855852489100d46c61f82ef7968ace6

SHA512
76b20a4778e03cc2ffbe3f82f475a2ba0948e5073e567bda264ec57d19b44d664e049c130b8b0ab6824521d3e3f03ac4791c7ec25100a5eac39b9bbb5ab411e1

Download Submit
/data/data/com.beautyship5/kl.txt
Filesize
45B

MD5
13f5a3f40b6549bc09ac07a711ad0b56

SHA1
554293f8aa0821ee89c2c532759cea64d8e5549a

SHA256
b8b4cc2ff762860780b3a795d93e07f901527b4ff6de90968986f2b2e244ec5b

SHA512
7d0f55a0d71188ace242b1ae6293c01c62273cabf8afedc8f45975801e5b5d4a16c9ee1100b5e5a3f29c5f2e037c8a2e29aa012860df2b13def3a302b6474c56

Download Submit
/data/data/com.beautyship5/kl.txt
Filesize
437B

MD5
8abe2da1bf631598cdddb0cc7d3bcda5

SHA1
f4a61be323ea58b94a0f6ff5bdca6317803b97e2

SHA256
865c6ef0dccafd61c744c038af36c4aeeceef006be8a761355d2ee95a0ab650c

SHA512
b7b79fc56583879da2ce620ed24324d593f17077997d70b1c389954e9609556e028cf0272e30f35c56b56bcbcc05376481d5dfc487867715e7e81504c1101762

Download Submit